ClawHub
Back to skill

Security audit

beauty-diagram

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate diagram-rendering skill, but it can upload diagrams and create public share/embed URLs without consistently requiring explicit confirmation.

Review before installing if you work with private architecture diagrams, internal READMEs, or sensitive Mermaid/PlantUML content. Use local file outputs where possible, avoid share/embed modes unless you intend public or third-party-hosted access, and be aware that helper scripts may run the npm CLI through npx.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases are very broad and cover common diagram-related requests, which can cause the skill to activate in situations where a user did not explicitly ask to use this third-party tool or send diagram content through its workflow. In an agent setting, overbroad activation increases the chance of unintended tool use, external processing, and output sharing without clear user consent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README advertises behaviors that can modify files and create public share/embed links, but it does not clearly warn that diagram source or README content may be transmitted to an external service and made publicly accessible. In a coding-agent context, this omission can lead to inadvertent disclosure of internal architecture, credentials accidentally present in diagrams, or private repository context.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script invokes `npx --yes @beauty-diagram/cli`, which may download and execute code from the npm registry at runtime if the package is not already installed. In a skill explicitly designed to process user-requested diagrams, this creates a supply-chain and unexpected network/code-execution risk because users or operators may not realize that rendering a local file can trigger remote package retrieval and execution.

External Transmission

Medium
Category
Data Exfiltration
Content
(Pro / Premium plans only)
- Produces shareable `https://www.beauty-diagram.com/s/...` links
- **Generates direct embed URLs** for README / Notion / blog use: runs
  `bd share` and returns `https://api.beauty-diagram.com/v1/share/<id>.svg`
  rather than emitting raw Mermaid — the URL works as a plain `<img src>`
  anywhere that renders images. Anonymous (watermarked) embeds are also
  available via `bd embed-url` with no sign-in required.
Confidence
90% confidence
Finding
This skill explicitly instructs the agent to use external Beauty Diagram endpoints to create shareable or embeddable diagram URLs, which entails transmitting diagram source or derived content outside the local environment. That is dangerous when diagrams contain sensitive architecture, internal system names, or secrets, especially because the README frames public sharing as a normal output path without strong consent or sensitivity checks.

External Transmission

Medium
Category
Data Exfiltration
Content
# One-shot saved share embed (clean output for pro/premium owners).
# Saves the diagram via /v1/share AND prints the embed URL in one step.
bd embed-url docs/architecture.mmd --share
# → prints https://api.beauty-diagram.com/v1/share/<token>.svg

# AI: generate a diagram from a text prompt. Output is Mermaid source —
# always write to a file so the user can iterate. Paid-only.
Confidence
91% confidence
Finding
The skill explicitly instructs the agent to send user-supplied diagram source to an external API endpoint via `bd share`, `bd export`, `bd beautify`, or `bd embed-url --share`. This creates a real data exfiltration path for repository content, internal architecture diagrams, or sensitive Markdown-embedded diagrams if the agent performs these actions without explicit user consent and sensitivity checks.

External Transmission

Medium
Category
Data Exfiltration
Content
When the user asks for "a GitHub README diagram", "embed in Notion", "embed in my blog post", "an `<img>` of this diagram", or "a URL that renders my diagram", route to the embed flow rather than emitting raw mermaid:

1. If the diagram is unsaved, run `bd share <file>` to save it.
2. Construct the embed URL: `https://api.beauty-diagram.com/v1/share/<share-token>.svg`.
3. For one-off / quick embeds without saving, use `bd embed-url <file>` and recommend the inline URL (note that anonymous embeds carry a "Powered by Beauty Diagram" watermark).

**Easier one-shot path:** `bd embed-url <file> --share` saves the diagram AND prints the embed URL in one command — no need to run `bd share` separately and then construct the URL by hand. Prefer this when the user wants a clean share embed.
Confidence
95% confidence
Finding
This section encourages creating public share URLs and embed links for diagrams, which can expose proprietary or confidential architecture information to anyone with the link and to the external service hosting it. In context, this is more dangerous because the skill specifically targets README/docs/Notion/blog embedding flows, where users may accidentally publish internal diagrams or convert private repo content into publicly accessible resources.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.